Risk Reduction and Resiliency Modeling Software for Industrial Control Systems

Traditional approaches to risk reduction which focus exclusively on threats, vulnerabilities, and consequences of exposure may not be ideally suited to assess complex and highly connected systems critical to the successful completion of mission objectives. Therefore, cyber resilience should be considered within a variety of domains (physical, information, social, cognitive) which include software, firmware, interconnected hardware, sensing components, the supply chain, and ultimately actions of the cybersecurity professionals who interact with a system to sustain operations. To this end, G2 Ops envisions a multi-disciplinary approach towards defining a quantitative resiliency metric which encompasses: Identification of the critical functions and features (i.e., operational performance requirements) specific to Industrial Control System (ICS) components typically present in automated shipboard systems (hull, mechanical and electrical (HM&E)); Identification of key performance parameters (KPPs) for ICS components and their correlation (i.e., role) in the fulfillment of mission objectives; Identification of external data sources which might contribute to the definition of quantifiable cyber resiliency metrics; Suitability of technical controls specified in the DoD Risk Management Framework (RMF); and Application of best practices (technology, processes, compensating controls) which can be used to “buy down” the implementation cost of unnecessary cybersecurity capabilities through cost and schedule evaluation.